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ABSTRACT 




This paper identifies the methods and equipment through which automa- 
tion is becoming a major factor in testing and launching Saturn IB space vehicles. 
The merits of a digital guidance computer and its impact in extending automated 
checkout are stressed; also a logical basis is established for computer and manual 
test control. Hardware and software elements of the automated system are de- 
scribed, and details pertaining to reliability are emphasized. A concluding ap- 
praisal suggests that automation will play an expanding role in future test and 
launch operations. 
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SUMMARY 


This paper identifies the methods and equipment through which automa- 
tion is becoming a major factor in testing and launching Saturn IB space vehicles. 
The merits of a digital guidance computer and its impact in extending automated 
checkout are stressed; also a logical basis is established for computer and manual 
test control. Hardware and software elements of the automated system are de- 
scribed, and details pertaining to reliability are emphasized. A concluding ap- 
praisal suggests that automation will play an expanding role in future test and 
launch operations. 


INTRODUCTION 


Automation contributes to vehicle reliability from manufacturing through 
prelaunch checkout. Because of the speed of the digital computer, more time is 
available for testing, fault analysis, investigation, and corrective action. As 
launch densities increase, conservation of vehicle checkout time will become 
more urgent. The computer checkout system will significantly reduce the burden 
imposed upon the launch crews by multivehicle missions. It is the aim of this 
paper, therefore, to present a broad picture of automation and the means for ob- 
taining reliability assurance in launch operations of the Saturn IB space vehicle 
system. 


EVOLUTION OF AUTOMATION IN THE SATURN VEHICLE SYSTEM 


Automation is not new to space vehicles or the associated checkout and 
launch equipment. Space vehicles have been launched for many years with auto- 
mated fii’ing-eommand-through-liftoff sequences, time-based inflight event pro- 
graming, and computer calculated velocity and position parameters to achieve 
planned trajectories. While this degree of automation has existed at least since 



the days of the Redstone and Jupiter systems, important new concepts of automa- 
tion are evolving in the Saturn space vehicle programs. 

The Saturn inertial guidance system is designed around a gyroscopically 
stabilized platform with accelerometers and a digital computer. Primary func- 
tions of the computer are; calculating velocity and position of the vehicle, using 
this data for computing the trajectory, and generating steering signals for the 
vehicle control system. The computer must also issue a cutoff signal to the 
propulsion system when mission velocity is achieved. An adaptive guidance 
technique is used so that mission success is possible with loss of one or more 
engines; that is, the computer optimizes flight trajectory for propellant con- 
servation. Analog computers are sufficiently accurate for many purposes, but 
do not provide the versatility required for guidance and master control of space 
vehicles or the degree of accuracy possible with a digital computer. 

Versatility requirements and accuracy enhancement therefore led to the 
use of a digital computer with the capability of performing a multitude of func- 
tions in addition to its guidance role. These include orbital checkout, response 
to flight path correction signals from the ground, inflight sequencing of events 
that formerly had been performed by an electromechanical program device, and 
automated prelaunch checkout of the guidance and control system. Digital com- 
puters are inherently more flexible and accurate than analog computers. This 
flexibility results from a data storage or memory capacity which allows a pre- 
stored program to operate upon data from external sources. Thus, functions are 
changed by program changes instead of by rewiring patchboards or making other 
hardware changes. This storage capability also results in fewer arithmetic 
units required to perform a given computation. Also, since integration can be 
performed by a series of additions and multiplications, integrator arithmetic 
units are not required [1], Accuracy in electronic analog computers is limited 
by component tolerances to approximately 0. 01 percent, whereas digital com- 
puter accuracies are independent of component tolerances and depend upon word 
length or number of bits used to define a parameter [2] . 

The inclusion of a digital computer on the Saturn vehicle necessitated 
installation of a ground based digital computer for checkout of the guidance and 
control system. With all the capabilities of the ground based computer available 
for test and checkout purposes, the concept evolved to extend computer opera- 
tions beyond the guidance and control system areas. Additional functions that 
have evolved are discrete and analog signal recording and display, measurement 
circuitry calibration, event programing for test and limited launch sequences, 
fuel temperature averaging calculations, and signal transmission between the 
launch control center (LCC) and automatic ground station (AGCS) computers. 
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Incorporation of launch-critical interlocking circuitry does not appear to be 
feasible at present as this would greatly complicate an already complex pro- 
graming effort, make late changes to the system difficult, and degrade launch 
reliability. Considerable concern exists regarding the utilization of the com- 
puter as a launch sequence command element. Obviously, failures in the com- 
puter or auxiliaries could occur that would cause varying degrees of trouble, 
depending largely on time of occurrence. Electrical support equipment (ESE) 
hardwire safing circuits have been provided to restore the vehicle to a safe 
condition in the event of a computer or auxiliary system failure. 

To implement automation, it has been necessary to establish experi- 
mental and development facilities at the Marshall Space Flight Center for de- 
veloping hardware, proving all launch site computer programs, and training 
personnel. Three computer facilities have been constructed to simulate the 
flight vehicle computer ESE system for the Saturn I, IB, and V programs. These 
facilities, while costly, are essential to a successful automation program. The 
Saturn I/IB facility is shown in Figure 1. 
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The Saturn IB launch system is selected for specific description because 
its hardware and software are substantially defined and illustrate automation 
concepts for Saturn V. Major elements of the automated system are shown in 
Figure 2. 
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FIGURE 2. SATURN IB LAUNCH SYSTEM SIGNAL 
FLOW DIAGRAM 

THE GROUND SYSTEM 


The RCA IIOA general purpose digital computer (system computer) was 
selected primarily to perform prelaunch checkout on the vehicle digital guidance 
system. It possesses a magnetic core memory of 32,768 words. It is not the 
fastest computer available but it has been designed for the job. The computer 
can recognize and respond to eight priority levels or channels stimulated by 
automatic sensors or manually operated switches I 3]. As an example, the 
computer might be performing a hydraulic pump power-up sequence when a loss 
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of control voltage occurs. The computer would be advised of this condition by a 
signal from the ESE and, through its priority interrupt feature, would shift its 
program to initiate power off command to the hydraulic pumps. Thus personnel 
and vehicle can be protected against uncontrolled engine movements. Another 
feature of prime importance is the data link section that ties the LCC and the 
AGCS computers together via coaxial cable. This link will be as long as six 
miles for the Saturn V launch complex. Signal transmission rate is approxi- 
mately 133,000 bits per second. An automatic parity bit error detection system 
is part of the link. In the event that a bit is lost, the sending computer will re- 
peat the message. Thus message transmission and receipt are safeguarded. 

Two computers are used for similarity of checkout and launch procedures with 
the Saturn V program. The LCC computer commands the AGCS computer to 
perform test programs and issue signals initiated from the ESE stations. How- 
ever, each computer may communicate with the other; i. e. , signal flow is 
bidirectional. Test programs are generally stored in the AGCS computer; the 
LCC computer provides the interface link with launch operations personnel. 

The digital events evaluator (DEE) is a system for scanning all signifi- 
cant discrete events from the ESE or vehicle and provides a real time printout 
of changes on any of its 2160 input lines. An order-of-events program will be 
available to show deviations from planned sequencing of any event in the vehicle 
test or launch operations. The system delivers its output primarily by line 
printer, but also has paper tape or magnetic tape recording capability. The 
function of monitoring significant discrete commands and indications during test 
and launch has, until recently, been performed by strip chart recorders with 
approximately five milliseconds resolution. The DEE will provide typed copy 
with a time resolution of approximately two milliseconds. The main advantage 
over the old system is the reduction of time and effort required to examine and 
interpret the data. 

The ESE performs several vital roles in automation although it is pri- 
marily associated with manual techniques. First in importance, the ESE provides 
the means through which the computer operates and keeps launch-experienced 
personnel in command during test and launch operations ( Fig. ' 3) . It also pro- 
vides flexibility of testing and the means for troubleshooting system problems 
that cannot feasibly be done with an automated system. The ESE provides signal 
distribution and conditioning of all discrete commands into and out of the system 
computer; provides signal isolation and filtering for certain analog functions; 
reduces computer programing burden by incorporating function generation and 
network logic; and, through hardwire connections, provides backup to the data 
link for those circuits essential to safing the vehicle. Two notable items of 
automated ESE are the launch and ignition sequencers. The launch sequencer 
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FIGURE 3. ESE-COMPUTER-VEHICLE FUNCTIONAL INTERFACE 
DIAGRAM 


is energized at firing command and performs switching to initiate numerous 
launch critical functions such as stopping LOX bubbling, power transfer, LOX 
and fuel lines ejection, and vehicle release. The device is driven from the 
count clock and automates launch operations for approximately 163 seconds 
before liftoff. It also commands the ignition sequencer to begin a program of 
starting the eight engines. This hardware is designed to provide approximately 
100 milliseconds interval between starting pairs of diametrically opposed engines. 
The system computer could perform all these functions quite handily; because of 
its component count, however, it is not considered as reliable as this ESE. 

Unless all engines satisfy a minimum thrust requirement within three seconds 
after ignition command, cutoff will be given. While cutoff has not marred a 
single Saturn launch, the requirement that all engines produce adequate thrust 
before vehicle release significantly enhances the probability of mission success. 
The scope of this paper precludes definition of all ESE in the Saturn IB program. 
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Functional categories of ESE most closely associated with automation are shown 
on the system diagram of Figure 2. Figure 3 illustrates the relationship of the 
ESE an d computer and shows some detail of the system elements. 

Propellant loading and unloading operations are automated to a high 
degree. For safety and reliability, however, complete manual control is avail- 
able through the LCC stations. Automation is accomplished through a propellant 
tanking computer system (PTCS) for each propellant of both propulsion stages. 

It is a hybrid computer system in that analog and digital data are processed. 

The PTCS receives analog signals generated by vehicle tank level indicators. 
These signals are used by the PTCS to control bulk loading rates, time for 
activating cryogenic replenish control, and initiation of slow fill sequence for 
the RP-1 tank. The RP-i tank is filled approximately two percent over mission 
requirements, and final level is adjusted by initiating level-adjust sequence in 
the launch countdown. The level adjust is accomplished through a drain valve 
controlled by the PTCS. All cryogenic propellants are maintained at 100 percent 
mission requirements by the replenishing valves or, in the case of the LH 2 , a 
combination of slow bulk filling and replenishing valve action. The system 
checkout computer provides monitoring and display for this system and performs 
calculations based on RP-1 temperature to correct liftoff mass [4], 


THE FLIGHT SYSTEM 


The launch vehicle digital computer ( LVDC) was required primarily for 
trajectory optimization for propellant conservation, high accuracy, and master 
control over vehicle functions during pre launch checkout, launch, and orbital 
operations. The computer has two magnetic core memories which may be used 
in parallel or series. The parallel arrangement may be used with a selection 
network to provide higher reliability, or the memories may be used serially to 
provide more storage capacity. Triple modular redundancy is utilized in the 
logic portion of the computer so that one spurious output or the failure of a single 
component will not affect the output signal. This is accomplished through majority 
voting (two out of three inputs) establishing a true output signal. The computer 
may be commanded through the data adapter from the ground based digital com- 
mand system to interrupt its program and perform priority instructions, or it 
may receive priority information from a flight sensor that can cause program 
alteration. When the instructions have been performed, it will resume the 
interrupted program. A few of the operations that the computer may perform 
are-, computer self-test, mission simulation, telemetry check, stabilized plat- 
form performance monitoring, steering command generation, event sequencing, 
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and S-IVB engine restart at the proper time for spacecraft injection into a lunar 
trajectory. The launch vehicle data adapter ( LVDA) provides signal conditioning 
for all signals from the computer to the controlled equipment, provides temporary 
data storage, performs error monitoring and detection, and controls the inputs 
to the LVDC. It utilizes triple modular redundant circuits in several vital sub- 
systems to achieve high reliability. In short, it functions as the interface unit 
between the LVDC and all systems associated with it [5], 

The digital data acquisition system (DDAS) output of the PCM/FM teleme- 
try system is transmitted over coaxial cable and is a most important pre launch 
information link between vehicle and ground. It eliminates the need for hundreds 
of umbilical hardlines that would otherwise be required for measurement cali- 
bration and noncritical vehicle status indicator functions. It is a major element 
of the automated system and offers the possibility of further reduction in hard- 
wire links to the ESE. Three telemetry systems for transmitting information 
are available on each stage of the Saturn vehicle, but the PCM/FM system (from 
which the coaxial output is obtained) is the only one that interfaces with the sys- 
tem computer and is the most generally used. Each stage can transmit digital 
information into the ground computer through a ground DDAS receiving station. 
The ground station stores the data received in magnetic cores and makes the data 
available to the ground computer upon request [3, 6]. After liftoff the same 
information is transmitted by an RF PCM/FM transmitter. All significant ve- 
hicle analog data other than vibration and acoustic measurements are converted 
to digital values and transmitted to earth through the system. On the 
Instrument Unit, approximately 288 out of 315 transmitted signals are included 
on the DDAS. Thus the DDAS is the primary information system for automated 
and manual checkout. Many of the measurements applied to the PCM/FM sys- 
tem are also applied to the FM/FM system to give higher reliability through 
redundancy. Perhaps the most significant capability of the PCM/FM ground- 
computer system is that inflight data can be received and displayed on a real 
time basis. Real time display is achieved through the six cathode ray tubes and 
ESE control stations located in the LCC. Launch operations personnel will 
therefore have the capability of detecting anomalies as soon as they occur 
(Fig. 4) . 

Automation will be most useful in checkout of the vehicle measuring 
systems as there are well over 1300 measurements planned for the Saturn IB. 
Some of the transducers used are: force balance accelerometers for structural 
bending; bourdon tube potentiometers for pressure; thermistors, thermocouples, 
and resistance thermometers for temperatures; piezoelectric accelerometers 
for vibration; capacitance probes for liquid levels; potentiometers for position; 
and flowmeters for flow rates 1 7] . Each measurement signal conditioning 
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FIGURE 4. TYPICAL STAGE DIGITAL DATA ACQUISITION SYSTEM 


circuit must be verified near launch time to assure the validity of flight data. 

This check is performed through the remote automation calibration system 
(RACS) (Fig. 5) . It consists of a ground control station connected by hardwire 
through each stage umbilical to a measuring selector control package on the 
stage. The measuring selector is connected to the measuring rack, which is 
connected to the transducers. As many as 27 of these with 20 measurements 
per unit may be accommodated by one selector control package. Any measure- 
ment circuit may be selected from the ground control station in high or low 
range. Circuitry and switching provisions are included in the measuring racks 
to simulate the transducers' outputs at the high and low points of their calibration 
curves. These simulated transducer outputs are fed into an amplifier and con- 
verted to a signal level (usually 0 to 5 volts) compatible with the. DDAS system. 
The entire operation can be performed by the ground system computer. The 
computer can also compare the measured values with prestored data and display 
the results including out-of-tolerance values at control stations in the LCC. 
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FIGURE 5. REMOTE AUTOMATIC CALIBRATION SYSTEM 


Thus the RACS system is highly compatible with computer controlled checkout 
and provides for testing approximately 60 percent of the measurement circuits 
in a matter of minutes. Many of the measurements do not require signal con- 
ditioning and hence are not a part of the RACS. These are available to the sys- 
tem computer via DDAS, however, and therefore may be displayed and recorded 
in various subsystem tests and the launch sequence. 

The switch selector provides the means for master control of each stage 
from the LVDC (Fig. 6) . From liftoff to orbital injection, approximately 88 
commands from the LVDC are decoded and channeled to operating components 
by the switch selector. Some typical command functions are: firing stage 
separation initiators, firing retrorockets , starting S-IVB engine, jettisoning the 
launch escape tower, and engine cutoff. The switch selector's binary decoding 
capability reduces substantially the connectors and wiring required throughout 
the vehicle. Each switch selector has a capacity of 112 individual output com- 
mands; these are selected by an eight bit binary word from the LVDC. Before 
any output gate is opened, the LVDC examines a verification word from the input 
register and determines whether the correct word was set into the input register. 
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FIGURE 6. SWITCH SELECTOR COMMAND SYSTEM 


If not, the LVDC will issue a reset command to restore the input register to its 
initial condition. The LVDC will then issue the binary complement of the original 
word and gate the same channel the original word would have gated under normal 
circumstances. This word verification check and the ability of the switch selec- 
tor to issue the same command from the word complement greatly enhance event 
programing reliability. Redundancy is used in the design of the switch selector 
and its hardwire link to the LVDA. Commands to the input register and register 
verification lines are through separate connectors; dual relays are used for stage 
select, reset, and output gating commands. One set of command hardwires will 
be provided for control of vehicle function during checkout and launch. Thus, 
through the Instrument Unit stage umbilical, a maximum of 112 events can be 
controlled on each stage from the ESE and ground system computer with only 22 
hardwires. One hardwire control panel will exist in the LCC and several other 
command stations will have access to the control lines through the system com- 
puter. 
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AUTOMATED SYSTEM SOFTWARE [6, 8] 


Approximately 80 computer test programs are planned for the early 
launches of the Saturn IB space vehicle. In addition to these, some 40 opera- 
tional programs will be required to guide the computer through all the operations 
necessary to perform the test programs. Operational programs control or 
manage the overall operation of the computer; tasks such as a priority interrupt, 
causing data to be read in from magnetic tape to memory; computer self-test; 
and data link control are examples (Fig. 3) . Operational programs do not change 
and may be thought of as an integral part of the computer. Test programs are 
designed to perform precise functions on specific hardware; as the hardware 
changes, so must the test program change (Fig. 3) . Computer test programs 
for the first launch are associated primarily with the LVDC/LVDA, stabilized 
platform, flight control system, switch selector, propellant loading, measuring 
system, and emergency detection system (EDS). Examples of test programs in 
each system, respectively, are: simulated flight, LVDC switch selector test, and 
LVDC/LVDA discrete output test; accelerometer monitor and azimuth laying; 
S-IB A Q gain test and S-IB overall steering test; system computer switch selector 
channel test; propellant loading and monitoring; DDAS/RACS calibration; and 
engine out abort test [ 9] . 

Although many computer language systems exist, no single system was 
suitable for the numerous government and contractor-owned computer test 
facilities involved in qualifying all stages of the Saturn vehicle. It is axiomatic 
that the reliability attained in the Saturn program has been the result of a rig- 
orous checkout program executed by personnel experienced in manual checkout 
techniques. It is to utilize this store of experience and to exercise compre- 
hensive test program control that a common problem -oriented language is being 
developed. The language must be understandable in terms of manual checkout 
techniques, computer translatable into the system computer/machine language, 
and comprehensive to implement the multitude of instructions necessary to per- 
form the tests. This system for test engineer/computer communication has been 
assigned the acronym ATOLL for acceptance, test, or launch language. 
Mnemonic symbols are used that generally are logical derivations of the func- 
tions to be performed. Most operator functions are defined by four characters 
such as BEGN for BEGIN, EXEC for EXECUTE, DISI for DISCRETE IN, ALGE 
for ALGEBRAIC COMPUTATION, etc. ATOLL is not as yet sufficiently de- 
veloped to implement many launch checkout programs; thus another more de- 
tailed language system, symbolic language assembler program (S^AP), will be 
used for most programs for the first Saturn IB launch. The goal is ATOLL, 
however, and more tests will employ it as development progresses. The general 
procedure for preparing ATOLL test programs is shown in Figure 7. 
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FIGURE 7. ATOLL PROGRAM DEVELOPMENT 


A disturbing aspect of computer controlled operation is that software is 
just as vital to system performance as hardware ( Fig. 3) . An undiscovered 
programing error could have the same effect as a malfunctioning relay or other 
component. Therefore, it is necessary that all programs be thoroughly tested 
and "debugged." Computer programing evolves through four distinct phases; 
analysis, design, coding, and checkout. Analysis requires detailed specification 
writing of all test parameters and functions; design entails translation of the 
specifications into step by step statements of the problem; coding consists of 
writing these test instructions and data in a source language (ATOLL, SLAP, 
etc. ) that will precisely control and command the computer to perform all 
operations; and checkout is, as the name implies, a "debugging" process. 
Documentation characteristic of the respective phases consists of detailed test 
specifications, program flow charts, source program printout and cards, and 
finally the magnetic tape and card deck machine language program. To generate 
the first Saturn IB test and launch programs and supporting documentation, it is 
estimated that an effort of approximately 21 man years will be required. 


13 








BENEFITS, DISADVANTAGES, AND PROJECTIONS 


The tremendous speed of the digital computer has revolutionized repeti- 
tive industrial processes but has not advanced space vehicle launch schedules. 

The time required for individual tests has been reduced but more testing is 
being done [6] . More testing inevitably produces more reliable flight vehicles. 
Thus, automated techniques are providing the basis for higher reliability. Day- 
to-day tests in factory checkout provide data for determining component parame- 
ter variation. Libraries of test records may be stored on magnetic tape or 
typed copy in a fraction of the space required for strip chart records. Auto- 
mated techniques facilitate solutions to problems because of the immediate 
availability of test results on typewritten copy [6]. Through rapid distribution 
of test data, all organizational elements concerned may simultaneously focus 
upon problem areas. Errors in interpretation and transposition are completely 
eliminated. Analysis of the data is much easier than extracting data from strip 
chart records. The data are also more accurate. Repeatability and accuracy 
are positive factors for computer controlled tests. The "canned" tests are all 
the same, and any deviation in results between tests would incriminate the tested 
system rather than lead to speculation regarding what, when, and how human 
operators had introduced a stimulus and observed a result. Automated test 
programs will provide significant time savings in redundant circuit verification 
as redundancy is extensively used for reliability enhancement in the flight con- 
trol computer, the EDS rate gyros, and the LVDC. Real time display of flight 
performance parameters should prove to be of substantial value in analyzing 
various flight system failures arid correcting spatial attitudes during orbital 
maneuvers. 

Obviously automation is not the solution to all test and checkout problems. 
Some definite disadvantages must be recognized. Training of personnel to ef- 
fectively use automated techniques is a substantial and continuing task. New 
organizations or contracts must be established to provide programing and docu- 
mentation services. Flexibility of testing is somewhat restricted because the 
cost- to -benefits ratio for nonrepetitive testing is too high. The high speed 
capability of the computer makes it susceptible to system noise, necessitating 
the use of signal conditioners for low level analog hardwire data. Finally, the 
automated system is new and therefore must be treated with considerable re- 
serve as a major launch command element. 
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All the capabilities of the ground system computer are not presently being 
used in the launch sequence. This is consistent with the basic concept of relia- 
bility. Only time and operating experience can provide the basis for establishing 
full confidence in the system computer as a major launch command element. 

Thus the Saturn launch system is designed to use the computer and ESE to pro- 
vide maximum flexibility and safety in launch operations. As the computer sys- 
tem proves its reliability, and system hardware and software engineers get a 
better understanding of what should be automated, greater use will be made of 
the computer. As with any new concept, change evolves gradually and the first 
steps are the longest. Some possibilities for future computer operations are: 
utilization of the function generation capabilities of the computer to apply ramp 
function stimuli to the guidance and control system components; elimination of 
many analog recorders used for currents, voltages, and transducer measurements; 
absorption of some ESE event logic chains; pressure switch calibration; and RACS 
flight verification of measurement transducers. 
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